PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Web & REST API Security Explained

aikido.dev | advisory | #rest-api | #api-security | #authentication | #best-practices | #authorization | #input-validation | #oauth | #rest | #oauth2
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Web and REST APIs power modern software but become open doors when insecure. Essential practices include OAuth 2.0 authentication, strict authorization, and input validation.
Published
Collected

Related coverage

blog · bugbunny.ai
Web Application Security: The Controls That Still Matter Most
Web application security where it actually fails: server-side authorization on every object and action, safe session, cookie and CSRF behavior, validation for uploads and APIs, and retesting.
blog · labs.cognisys.group
Keys to the Kingdom Live Stripe Credentials Exposed via Unauthenticated OAuth Endpoint
There is a particular category of finding that stops you mid-test. Not because it is technically complex, but because of what you are looking at. A single unauthenticated GET request that returns live payment credentials for a platform processing real customer transactions is one such finding.
blog · netspi.com
API Security Testing: The Overlooked Frontline in Application Penetration Testing
APIs expose backend logic and sensitive data directly; targeted API security testing uncovers broken authentication, excessive data exposure, and access control flaws that traditional pentests miss.
blog · netspi.com
A Not So Comprehensive Guide to Securing Your Salesforce Organization
This Salesforce security primer covers unintentional data exposure through unsecured SOQL in Apex code, cleartext credentials, managed package namespaces, and REST API access patterns.
blog · netspi.com
Getting Started with API Security Best Practices
API security remains underprioritized as usage surges; the 2023 OWASP API Security Top 10 still leads with BOLA and broken authentication, and manual testing is needed where scanners fall short.
advisory · bishopfox.com
InterSystems Cache 2017.2.2.865.0 and 2018.1.2 Multiple Vulnerabilities
A Bishop Fox advisory on XSS, XXE and insufficient authorization in InterSystems Cache 2017.2.2.865.0 and 2018.1.2, where stored XSS can escalate privileges and exfiltrate data.
Back